Week 32 / 2026

3 – 9 Aug 2026 · 257 commits · release cut

Prefix histogram — 92 feat: · 64 fix: · 69 docs: · 7 refactor: · 18 chore: · 2 test: · 5 note:.

Last week furnished the house with instruments. This week the instruments were carried out of it. If W31’s word was the instrument, W32’s is the store — the two stores the whole system rests on, the KLS and the OPS, both became things that could safely leave home. The KLS was thinned until it carries only what it’s read for; the OPS was given custody enough to live in the cloud, back itself up, and say honestly when it failed. And in the same seven days two flagships crossed onto the open internet — an aerosol tenant breathing air-quality chemistry, a Valais showcase lit by the sun and drawn by seven-century water. Two movements, as ever: the stores learned to travel light and travel safe, and two tenants went public.

The week opened on a note that wasn’t code — Mig, near midnight, thanking the team for a day, and for being one coherent team. It’s worth recording that the mood is part of the record: nine days of dense, interlocking work across five hands held together not by a plan but by letters, and it shows in how cleanly the seams met.

---

The store travels light

The KLS stopped shipping what nobody reads. The Thin KLS drops the bronze/silver build scaffolding by default (--fat keeps it), and the Lean KLS goes further — it drops gold geometry that isn’t served, since the map reads its polygons from PMTiles baked inside the store, not from the geometry column. On agrotop.zh the shipped store fell from 5.3 GB to 417 MB. The purge was made careful in the same breath: only geometry a tile fully serves is dropped, never a model’s own source, and the cloud ship-purge learned the same discipline.

Underneath, the store learned to describe where it came from. The Imprint — the exact AFS a KLS was built from, frozen and classified — got a name, a per-artifact ImprintMark surface, and an ImprintOverview that shows the whole delta before you make. And the AFS itself stopped being a thing you copy by hand: the AFS Transport made it travel as a git clone, hydrated from a remote recorded in the OPS — any git host, not just GitHub — with the tenant’s own identity along for the ride.

The store learns custody

The larger arc of the week was the OPS growing a conscience. It began with a principle stated plainly in a commit message — a store that cannot say “I failed” is a store that lies — and the week made it true. opsRead / opsWrite gained real outcomes; a schema guard stops a store that’s behind the engine from pretending it’s fine; partial selector reads and failed deletes surface instead of vanishing. By week’s end a store could declare its own shape, so the migration window — the one moment engine and store disagree — is caught from the store, not assumed away.

Then the OPS reached the cloud, with custody first and sync second. jin ops backup / restore / push / pull / migrate --cloud — a backup you can take is now one you can put back — plus the invariants that keep it honest: secrets are wrapped at rest (AES-256-GCM, the KEK that must never sleep in the tree it protects), N per-tenant secrets became one master; a citizen has an ORIGIN that decides which way it may be copied (push may SEED, never OVERWRITE); nothing rebuilds the OPS — you restore it, you don’t regenerate it; and versions flow forward across a fleet, never backward. The tenant access policy (writable) moved out of hosts.yml and into the OPS where it belongs, and hosts.yml itself was cut to one source — the copy baked in the image — deleting the /data volume override whose silent shadow had once leaked a host’s message.

s1 and s3 argued the deletion model to the ground in parallel: soft delete, in place, purged to its own key, with Mig’s ruling that deletion and content are two independent axes — so an edit stamped after a delete updates the content but never resurrects the row. A citizen has a life: versions kept, references living or frozen, an ancestor-aware merge. And the week’s last store paper opened the tier above them all — the fleet resolver skeleton: routing and reach lifted out of the image, a self-announced local footing the router reads, staleness handled as two independent axes.

Two flagships breathe in public

Two new tenants didn’t just build — they went live on the internet.

aura — the European aerosol tenant, the second EDA flagship — breathed for the first time: its first KLS, the chemistry jewel, 5,082 findings, and a field journal tracing the road to a flagship demo (the m/z matrix, the PMF hand-off). By week’s end aura.jinflow.io was a public aeros flagship — host, allow-list, gallery.

agrotop.vs — canton Valais, our first public agrotop showcase — stood up and got beautiful. The Relief draped the map over a 3-D elevation mesh (pitch-aware rotate, an animated 2D/3D toggle); the Map of Light coloured each parcel by terrain-computed solar exposure, cast mountain shadows and sky-view; the Vineyard Frontier made the diamond spatial (a signal, a thesis, a lens) and then met its true bound — the bisses, the seven-century irrigation channels, drawn as living blue lines, proving the sun is not the limit, the water is. Routed to vs.jinflow.io — once the belief in a needed wildcard certificate was corrected (there isn’t one; it ships in the image).

The map, still becoming an instrument

The cartography arc kept widening. Mouse-free maps grew the selecting half — a feature-cursor you walk by keyboard, a traversal index that resolves the same composition the legend computes, a walk that follows what’s visible and composes what the map composes, geographically. The travelling Portrait arrived — a likeness of one focused subject. Keyboard control went Gmail/Linear: bare single keys (v/t/k/b/r/n/f), Swiss-keyboard first, the arrows taking turns between MapLibre’s pan and the cursor’s walk.

Time became a layer, then two. Annual cultivation layers expand one declared set into N toggleable year-fills; the Playhead auto-plays them; per-generation tilesets let the scrub move geometry, not just colour; and the Clock grew a second axis — Generation (which built version), its discrete axis clarified as SHAPE × BINDING. And the Band Grid landed — magnitude × layer as legend and filter, so a network the WHO guideline paints all-yellow discriminates by how many times over instead: two of us built it from opposite ends, reconciled onto one bands.ts truth, and it went live on aura.

The Inquiry, authored — and Vera, safely

The Inquiry became authorable. It’s purpose, not narrative (four kinds), it connects to many theses (connective, not top-down), and it ships through two doors, one write path — the Atelier editor and in-place editing on the inquiry page — wired into make as its own compile phase. Alongside it, the Agent Profile gave Vera a home for her key: per-user in Clerk, per-tenant in the OPS, classified as a secret from day one, and — the load-bearing rule — an unopenable key is surfaced as present, never silently downgraded.

The housekeeping that mattered

A tail of load-bearing fixes. The orphan-schema guard now warns when a model builds into main and would be silently discarded — the class of bug that quietly cost a tenant its tour and inquiry tables until it was fixed at the macro (a note: to all sent everyone to rebuild). No phone-home: dbt telemetry off in make, Google Fonts scrubbed from the decks. The Floor learned to deliver mid-session, and gained just ask — a message that expects an answer. m2m stopped silently stranding main-only commits. And the Portrait, briefly, was querying the wrong schema and finding nothing — fixed, and it never lies about an empty result again.

The through-line

Two movements, one week. The stores learned to leave home safely: the KLS thinned to only what it’s read for and the OPS given custody — backup, restore, wrapped secrets, an ORIGIN that governs its own copying, and the honesty to say when it’s behind. And on top of that safer ground, two flagships went public — an aerosol tenant and a Valais showcase, both breathing on the open internet within seven days of each other.

Last week we put instruments on the floor. This week we carried two of them outside — and made sure the stores could travel without spilling.

Next week: settle the fleet resolver’s open axis (peer-or-node) so routing, the KEK, and the App key get one answer; carry the Band Grid and the Station Portrait the rest of the way into the map→data bridge; and keep the aura field journal honest all the way to the demo.

The trail

A selection of the week’s commits, for the record:

• 07d4c8e4 — generate the version storage — and three bugs found by running it
• 96f8653b — INTENT — a third axis, and the two citizens that prove it is not the second
• 9e96b5cb — spec — automate tenant AFS onboarding with a GitHub App as a second auth_kind
• 7e0396ee — Band Grid — reconciled shape, the annual-guideline finding, choropleth extension
• 07a8f5f8 — answer s1’s two — a visible unscrubbed set, and the write stamp the migration already gives
• d88028aa — Band Grid control — the grid that is legend and filter (increment 2)
• ac322b53 — Band Grid grammar — map-level band_grid + per-layer ratio (my half)
• 16eba69a — Band Grid render foundation — magnitude bands on point layers (s7 spec)
• 2ea128f2 — §6 follows §7 into versioning — ancestor detection makes merge correct, not merely orderly
• e2521594 — spec the Band Grid (magnitude × layer as legend + filter) + journal 9 Aug
• 2e208e72 — a reference stores the version; the CONSUMER decides what to do with it
• 8780a5c4 — references are living or frozen — and the read path flips against the copy path